Verifying the Agentless Deployment on USM Appliance

You can verify that you have successfully deployed the agentless monitoring in the following ways:

On Environment > Detection > Agentless, the status of the host displays a green check mark and the Agentless Status: displays Running.

On Environment > Detection > HIDS Control, make sure that you see "Agentless is running" in green.

On Environment > Detection > HIDS Control > HIDS Log, make sure that you see the periodic checks performed.

On Analysis > Security Events (SIEM), make sure that you see events coming from the monitored host or device.

AlienVault OSSIM Limitations: Both AlienVault OSSIM and the USM Appliance HIDS decoders are fully featured, with all of their information coming from the Plugin Feed Updates that USM Appliance and AlienVault OSSIM provide. However, AlienVault OSSIM lacks the depth of NIDS information that is provided to USM Appliance through the Threat Intelligence Updates.